About Quay IO

Procedure

1. Log in to your Red Hat Quay registry.
2. Click Organization in the navigation pane.
3. Click Create Organization.
4. Enter an Organization Name, for example, testorg.
5. Enter an Organization Email.
6. Click Create.

Procedure

1. On the v2 UI, click Organizations.
2. Click the name of the organization that you will create the robot account for, for example, test-org.
3. Click the Settings tab.
4. Optional. Enter the email address associated with the organization.

5. Optional. Set the allotted time for the Time Machine feature to one of the following:

   • A few seconds
   • A day
   • 7 days
   • 14 days
   • A month
6. Click Save.

Procedure

1. On the v2 UI, click Repositories.
2. Click the name of a repository.

3. Click the name of a tag. You are taken to the Details page of that tag. The page reveals the following information:

   • Name
   • Repository
   • Digest
   • Vulnerabilities
   • Creation
   • Modified
   • Size
   • Labels
   • How to fetch the image tag
4. Click Security Report to view the tag’s vulnerabilities. You can expand an advisory column to open up CVE data.
5. Click Packages to view the tag’s packages.
6. Click the name of the repository to return to the Tags page.

Procedure

1. On the Red Hat Quay v2 UI dashboard, click Repositories in the navigation pane.
2. Click the name of a repository that has image tags.
3. Click the menu kebab, then click Add new tag.

4. Enter a name for the tag, then, click Create tag.

   The new tag is now listed on the Repository Tags page.

Procedure

1. On the v2 UI dashboard, click Repositories in the navigation pane.
2. Click the name of a repository that has image tags.
3. Click the menu kebab for an image and select Edit labels.
4. In the Edit labels window, click Add new label.

5. Enter a label for the image tag using the key=value format, for example, com.example.release-date=2023-11-14.

   Note

   The following error is returned when failing to use the key=value format: Invalid label format, must be key value separated by =.

6. Click the whitespace of the box to add the label.
7. Optional. Add a second label.
8. Click Save labels to save the label to the image tag. The following notification is returned: Created labels successfully.
9. Optional. Click the same image tag’s menu kebab → Edit labels → X on the label to remove it; alternatively, you can edit the text. Click Save labels. The label is now removed or edited.

Procedure

1. Navigate to the Tags page of a repository.
2. Under Manifest, click the Fetch Tag icon.

3. When the popup box appears, users are presented with the following options:

   • Podman Pull (by tag)
   • Docker Pull (by tag)
   • Podman Pull (by digest)

   • Docker Pull (by digest)

     Selecting any one of the four options returns a command for the respective client that allows users to pull the image.

4. Click Copy Command to copy the command, which can be used on the command-line interface (CLI). For example:

   $ podman pull quay.io/quayadmin/busybox:test2

   Copy to Clipboard Toggle word wrap

Procedure

1. On the Red Hat Quay v2 UI dashboard, click Repositories in the navigation pane.
2. Click the name of a repository that has image tags.

3. Click Tag History. On this page, you can perform the following actions:

   • Search by tag name
   • Select a date range
   • View tag changes
   • View tag modification dates and the time at which they were changed

Procedure

1. On the Repositories page of the v2 UI, click the name of the image you want to delete, for example, quay/admin/busybox.
2. Click the More Actions drop-down menu.

3. Click Delete.

   Note

   If desired, you could click Make Public or Make Private.

4. Type confirm in the box, and then click Delete.

5. After deletion, you are returned to the Repositories page.

   Note

   Deleting an image tag can be reverted based on the amount of time allotted assigned to the time machine feature. For more information, see "Reverting tag changes".

Procedure

1. On the Repositories page of the v2 UI, click the name of the image you want to revert.
2. Click the Tag History tab.
3. Find the point in the timeline at which image tags were changed or removed. Next, click the option under Revert to restore a tag to its image.

Procedure

1. Log in to your Red Hat Quay registry.
2. Navigate to an Organization, repository, or namespace for which you are an administrator of.

3. Click Logs.

   

4. Optional. Set the date range for viewing log entries by adding dates to the From and To boxes.
5. Optional. Export the logs by clicking Export. You must enter an email address or a valid callback URL that starts with http:// or https://. This process can take an hour depending on how many logs there are.

Procedure

1. Select a repository for which you have administrator privileges.
2. Click the Logs tab.
3. Optional. If you want to specify specific dates, enter the range in the From and to boxes.

4. Click the Export Logs button. An Export Usage Logs pop-up appears, as shown

   

5. Enter an email address or callback URL to receive the exported log. For the callback URL, you can use a URL to a specified domain, for example, <webhook.site>.
6. Select Confirm to start the process for gather the selected log entries. Depending on the amount of logging data being gathered, this can take anywhere from a few minutes to several hours to complete.

7. When the log export is completed, the one of following two events happens:

   • An email is received, alerting you to the available of your requested exported log entries.
   • A successful status of your log export request from the webhook URL is returned. Additionally, a link to the exported data is made available for you to delete to download the logs.

Procedure

1. Navigate to a repository and click Tags in the navigation pane. This page shows the results of the security scan.
2. To reveal more information about multi-architecture images, click See Child Manifests to see the list of manifests in extended view.
3. Click a relevant link under See Child Manifests, for example, 1 Unknown to be redirected to the Security Scanner page.
4. The Security Scanner page provides information for the tag, such as which CVEs the image is susceptible to, and what remediation options you might have available.

Procedure

1. Navigate to Quay.io and select a repository.
2. In the navigation pane, select Builds.

Procedure

1. On the Builds page, click Start New Build.
2. When prompted, click Upload Dockerfile to upload a Dockerfile or an archive that contains a Dockerfile at the root directory.

3. Click Start Build.

   Note
   • Currently, users cannot specify the Docker build context when manually starting a build.
   • Currently, BitBucket is unsupported on the Red Hat Quay v2 UI.
4. You are redirected to the Build, which can be viewed in real-time. Wait for the Dockerfile Build to be completed and pushed.
5. Optional. you can click Download Logs to download the logs, or Copy Logs to copy the logs.

6. Click the back button to return to the Repository Builds page, where you can view the Build History.

   

Procedure

1. Add a chart repository by entering the following command:

   $ helm repo add redhat-cop https://redhat-cop.github.io/helm-charts

   Copy to Clipboard Toggle word wrap

2. Enter the following command to update the information of available charts locally from the chart repository:

   $ helm repo update

   Copy to Clipboard Toggle word wrap

3. Enter the following command to pull a chart from a repository:

   $ helm pull redhat-cop/etherpad --version=0.0.4 --untar

   Copy to Clipboard Toggle word wrap

4. Enter the following command to package the chart into a chart archive:

   $ helm package ./etherpad

   Copy to Clipboard Toggle word wrap

   Example output

   Successfully packaged chart and saved it to: /home/user/linux-amd64/etherpad-0.0.4.tgz

   Copy to Clipboard Toggle word wrap

5. Log in to Quay.io using helm registry login:

   $ helm registry login quay.io

   Copy to Clipboard Toggle word wrap

6. Push the chart to your repository using the helm push command:

   helm push etherpad-0.0.4.tgz oci://quay.io/<organization_name>/helm

   Copy to Clipboard Toggle word wrap

   Example output:

   Pushed: quay370.apps.quayperf370.perfscale.devcluster.openshift.com/etherpad:0.0.4
   Digest: sha256:a6667ff2a0e2bd7aa4813db9ac854b5124ff1c458d170b70c2d2375325f2451b

   Copy to Clipboard Toggle word wrap

7. Ensure that the push worked by deleting the local copy, and then pulling the chart from the repository:

   $ rm -rf etherpad-0.0.4.tgz

   Copy to Clipboard Toggle word wrap

   $ helm pull oci://quay.io/<organization_name>/helm/etherpad --version 0.0.4

   Copy to Clipboard Toggle word wrap

   Example output:

   Pulled: quay370.apps.quayperf370.perfscale.devcluster.openshift.com/etherpad:0.0.4
   Digest: sha256:4f627399685880daf30cf77b6026dc129034d68c7676c7e07020b70cf7130902

   Copy to Clipboard Toggle word wrap

Procedure

1. Enter the following go command to directly install Cosign:

   $ go install github.com/sigstore/cosign/cmd/cosign@v1.0.0

   Copy to Clipboard Toggle word wrap

   Example output

   go: downloading github.com/sigstore/cosign v1.0.0
   go: downloading github.com/peterbourgon/ff/v3 v3.1.0

   Copy to Clipboard Toggle word wrap

2. Generate a key-value pair for Cosign by entering the following command:

   $ cosign generate-key-pair

   Copy to Clipboard Toggle word wrap

   Example output

   Enter password for private key:
   Enter again:
   Private key written to cosign.key
   Public key written to cosign.pub

   Copy to Clipboard Toggle word wrap

3. Sign the key-value pair by entering the following command:

   $ cosign sign -key cosign.key quay.io/user1/busybox:test

   Copy to Clipboard Toggle word wrap

   Example output

   Enter password for private key:
   Pushing signature to: quay-server.example.com/user1/busybox:sha256-ff13b8f6f289b92ec2913fa57c5dd0a874c3a7f8f149aabee50e3d01546473e3.sig

   Copy to Clipboard Toggle word wrap

   If you experience the error: signing quay-server.example.com/user1/busybox:test: getting remote image: GET https://quay-server.example.com/v2/user1/busybox/manifests/test: UNAUTHORIZED: access to the requested resource is not authorized; map[] error, which occurs because Cosign relies on ~./docker/config.json for authorization, you might need to execute the following command:

   $ podman login --authfile ~/.docker/config.json quay.io

   Copy to Clipboard Toggle word wrap

   Example output

   Username:
   Password:
   Login Succeeded!

   Copy to Clipboard Toggle word wrap

4. Enter the following command to see the updated authorization configuration:

   $ cat ~/.docker/config.json
   {
   	"auths": {
   		"quay-server.example.com": {
   			"auth": "cXVheWFkbWluOnBhc3N3b3Jk"
   		}
   	}

   Copy to Clipboard Toggle word wrap

Procedure

1. Enter the following go command to directly install Cosign:

   $ go install github.com/sigstore/cosign/cmd/cosign@v1.0.0

   Copy to Clipboard Toggle word wrap

   Example output

   go: downloading github.com/sigstore/cosign v1.0.0
   go: downloading github.com/peterbourgon/ff/v3 v3.1.0

   Copy to Clipboard Toggle word wrap

2. Generate a key-value pair for Cosign by entering the following command:

   $ cosign generate-key-pair

   Copy to Clipboard Toggle word wrap

   Example output

   Enter password for private key:
   Enter again:
   Private key written to cosign.key
   Public key written to cosign.pub

   Copy to Clipboard Toggle word wrap

3. Sign the key-value pair by entering the following command:

   $ cosign sign -key cosign.key quay.io/user1/busybox:test

   Copy to Clipboard Toggle word wrap

   Example output

   Enter password for private key:
   Pushing signature to: quay-server.example.com/user1/busybox:sha256-ff13b8f6f289b92ec2913fa57c5dd0a874c3a7f8f149aabee50e3d01546473e3.sig

   Copy to Clipboard Toggle word wrap

   If you experience the error: signing quay-server.example.com/user1/busybox:test: getting remote image: GET https://quay-server.example.com/v2/user1/busybox/manifests/test: UNAUTHORIZED: access to the requested resource is not authorized; map[] error, which occurs because Cosign relies on ~./docker/config.json for authorization, you might need to execute the following command:

   $ podman login --authfile ~/.docker/config.json quay.io

   Copy to Clipboard Toggle word wrap

   Example output

   Username:
   Password:
   Login Succeeded!

   Copy to Clipboard Toggle word wrap

4. Enter the following command to see the updated authorization configuration:

   $ cat ~/.docker/config.json
   {
   	"auths": {
   		"quay-server.example.com": {
   			"auth": "cXVheWFkbWluOnBhc3N3b3Jk"
   		}
   	}

   Copy to Clipboard Toggle word wrap